Development and Demonstration of a TDOA-Based GNSS Interference Signal Localization System

Jahshan A. Bhatti, Todd E. Humphreys, The University of Texas at Austin, Austin, TX Brent M. Ledvina, Coherent Navigation, San Mateo, CA

Abstract-Background theory, a reference design, and demon­stration results are given for a Global Navigation Satellite System (GNSS) interference localization system comprising a distributed radio-frequency sensor network that simultaneously locates multiple interference sources by measuring their signals' time difference of arrival (TDOA) between pairs of nodes in the network. The end-to-end solution offered here draws from previous work in single-emitter group delay estimation, very long baseline interferometry, subspace-based estimation, radar, and passive geolocation. Synchronization and automatic localization of sensor nodes is achieved through a tightly-coupled receiver architecture that enables phase-coherent and synchronous sam­pling of the interference signals and so-called reference signals which carry timing and positioning information. Signal and cross­correlation models are developed and implemented in a simulator. Multiple-emitter subspace-based TDOA estimation techniques are developed as well as emitter identification and localization algorithms. Simulator performance is compared to the Cramer­Rao lower bound for single-emitter TDOA precision. Results are given for a test exercise in which the system accurately locates emitters broadcasting in the amateur radio band in Austin, TX.

I. INTRODUCTION

Despite its marvelous success over the last three decades, the Global Positioning System (GPS) has an Achilles' heel: its weak signals are an easy target for jamming. The National Space-Based Positioning, Navigation, and Timing Advisory Board in a recent white paper has concluded that the "United States is now critically dependent on GPS" [1]. The paper notes an alarming increase in the incidence rate of deliberate and unintentional GPS interference, which in some cases renders GPS inoperable for critical infrastructure operations. The white paper also notes the increasing availability of small and cheap GPS jammers known as personal privacy devices (PPDs). Although the advertised jamming coverage radius for these devices is small, typically 10 to 20 meters, their actual range may extend to tens of kilometers [2].

In one recent case of interest, a test version of the GPS ground-based augmentation system (GBAS) at Newark Inter­national Airport suffered from periodic interference due to a PPD aboard a truck traveling on a nearby highway [3]. The authorities took four months to track down the jammer. Continued monitoring in the Newark airport area after this incident indicates that during rush hours, there occur 4 to 5 interference events per hour, presumably due to PPDs [4]. GPS-synchronized cellular communications networks also re­port an increasing rate of periodic GPS outages, most likely due to passing PPDs. Although these networks are designed to fall back to a hold-over mode that is capable of maintaining

adequate synchronization for several days, such interference is nonetheless an annoyance for network operators.

Despite a recent effort by the Federal Communications Commission to discourage sale, purchase, and use of PPDs [5], there is reason to believe that they will only become more widespread in the future. The miniaturization and proliferation of GPS trackers will likely lead to an increased use of PPDs, despite their being illegal, as people seek to protect their privacy from invasive tracking [6]. To aid in enforcing laws against PPDs and jamming devices, there is a need for a persistent system capable of detecting and locating sources of jamming.

There is extensive literature on passive geolocation and time difference of arrival (TDOA) estimation. This paper develops an interference localization solution that is based on maximum likelihood TDOA estimation techniques which can be traced back to the 1970s [7-9]. These techniques are based on analysis of the cross-power spectral density (CPSD) of an emitter signal received at two sensors with some differential delay. The very long baseline interferometry (VLBI) community uses similar techniques to estimate the group delay between the received signals at separate reference stations [10].

For single-emitter TDOA estimation, it is often sufficient to choose the delay that maximizes the time-domain cross­correlation function [11-14]. However, for multiple emitters, analysis of the CPSD offers better resolution because pow­erful subspace methods such as multiple signal classification (MUSIC) can be applied to distinguish the frequency-domain components due to the various emitters [15].

In so-called passive geolocation, where the structure of the interference signals is not known a priori, the estimated TDOAs must be associated with emitters. In other words, one must decide from which emitter, if any, a TDOA measure­ment originated. Previous solutions to the data association problem, which require solving a computationally-demanding high-dimensional assignment problem, are reviewed in [16], and a computationally-efficient "tracking" extension of the problem is introduced. The effect of non-line-of-sight TDOA measurements due to multipath reflections and ways to detect those measurements through consistency checks are consid­ered in [14].

More particularly related to the problem of locating GPS interference sources, the work by Scott (J911) [17], Brown (JLOC) [18], and Chronos Technology (GAARDIAN) [19] focus on building cheap, low-network-throughput jamming-to-

978-1-4673-0387-3/12/$31.00 ©2012 IEEE 455

noise ratio sensors based on monitoring GPS carrier-to-noise ratio and automatic gain control (AGe) values, making them suited only for triggering and coarse localization. The work by Akos considers a network of sensor nodes using a low­cost Global Navigation Satellite System (GNSS) front end with AGe monitoring capability. Single-emitter interference localization is implemented using AGC values coupled with power-law path loss models for strong sources and cross­correlation-based TDOA estimation coupled with hyperbolic positioning for weak sources [11, 12].

The current paper offers a thorough overview of the emitter localization problem and describes the design and implementa­tion of an operational prototype system targeted to GNSS inter­ference source detection and localization. Theoretical models for received signals from multiple emitters are developed with appropriate assumptions for typical terrestrial emitter localization applications. For improved location precision, the prototype system is implemented with a spatially-distributed array of sensor nodes. The technique of synchronizing sensor nodes by clock-sharing via coaxial cable, as in [13], cannot be applied to this system because the sensors are separated by km-length baselines. Instead, the sensors make use of ambient radio frequency (RF) timing signals such as GPS or cellular code division multiple access (CDMA) to provide timing synchronization [11, 20]. For sensors on moving platforms, a position, velocity, and time solution (commonly obtained from GNSS signals) is required to synchronize the correlator's time and frequency offset.

The current work extends the previous work on TDOA­based GNSS interference source localization in [11, 13] by emphasizing simultaneous localization of multiple emitters. The multiple-emitter problem is addressed under reasonable assumptions about the emitter signal spectral shape, allowing the TDOAs to be detected and estimated in a straightforward subspace and least-squares fitting framework. The problem of TDOA data association is addressed through a simple but effective phase closure consistency check which assumes that the TDOA measurements are not significantly affected by multipath. A simulator developed to provide a testbed for validating theory and refining algorithms is described and both simulated and field-test results for the localization algorithms are provided.

II. SIGNAL MODELS

The models developed in this section form the basis of the TDOA estimation algorithms. The development is guided by derivations given in the radar literature [21], but adapted for passive geolocation.

A. Received Signal Model

Consider the following model for the signal transmitted by an interference source (hereafter emitter):

s(t) =As(t)cos(27T/et+<Ps(t)) . (1)

Here, As (t) is the instantaneous amplitude, Ie is the cen­ter frequency, and <Ps (t) is the transmitted beat carrier

phase. For convenience, consider the complex envelope s (t) = As (t) exp (j<ps (t)) and analytic representation s (t) = s (t) exp (27T/et) of the transmitted signal s (t). Note that analytic signals are a valid approximation when the complex envelope is slowly varying with respect to the center frequency (i.e. bandpass signals) [21]. Assume that the radio propagation channel induces a non-dispersive delay Tp (t), an attenuation A (15) that is a function of the average range 15 over the time-of­flight interval, and additive white Gaussian noise n' (t). Then the received signal r' (t) at the sensor can be modeled as

r' (t) = A (15) s (t - Tp (t)) + n' (t) , (2)

or with an analytic representation as

f' (t) = A (15) s(t - Tp (t)) + n' (t) , (3)

where n' (t), the analytic representation of n' (t), is a complex white Gaussian noise process with single-sided power spectral density No in WlHz. Other propagation effects like multipath and shadowing are not considered in this model.

For electromagnetic waves traveling in a vacuum, the prop­agation delay Tp (t) satisfies the implicit relationship

CTp (t) = v(re (t - Tp) - rs (t))T (re (t - Tp) - rs (t)), (4)

where C is the speed of light, r s (t) is the sensor position vector, and re (t) is the emitter position vector [22]. For short propagation distances and electromagnetic wave velocities, (4) can be approximated as

(5)

where r (t) = r e (t) - r s (t) is the relative position vector and p ( t) is the instantaneous range. The range rate is given by p (t) = r (t)T r (t) / p (t). In a further approximation that applies to emitters and sensors with moderate standoff distances and terrestrial velocities, the delay can be modeled linearly as

CTp (t) = p (0) + P (0) t (6)

over a small interval of time about t = O.

Let the relationship between the time tr at the sensor and true time t be given by

(7)

where Tr (tr) is the sensor's clock offset from true time. The clock is parametrized by a sensor clock offset bias a fO and clock offset drift or fractional frequency error a fl so that the sensor's clock offset time history Tr (tr) is given by

(8)

The linear model is valid for the clocks used in this application over a small interval of time about tr = 0 where small is defined as less than l O O ms for a temperature-compensated crystal oscillator or 10 s for an oven-controlled crystal oscil­lator.

456

Suppose that a mixing signal with nominal center frequency

Ic is generated with the sensor's clock. The mixing signal's phase <Pr (tr) is related to tr by

(9)

where <Pr,O is the initial phase of the oscillator. Let the mixing operation be modeled such that the resulting baseband signal '1' (t) is given by

'1' (t) = f' (t) exp (-Nr (tr)) = A (P) S (t - Tp (t)) exp (-N' (t, tr)) + n' (t) , (10)

where

<p' (t, tr) = 271" (tr - t + Tp (t)) Ic + <Pr,O (11)

and n' (t) = fI/ (t) exp ( -Nr (tr)) is a zero-mean baseband complex Gaussian process. The sensor clock model in (7) is used in (10) to express '1' (t) in the sensor's time base, denoted f (tr). The noise-free baseband received signal sr (tr) is given by

Sr (tr) = A (p) S (tr - T m (tr ) ) exp ( -j <Pm (tr )) , (12)

with the apparent delay T m (tr) defined as

(13)

and the received beat carrier phase <Pm (tr) given by

The full expression for the baseband received signal '1 (tr) is given by

(15)

where n ( tr) = n' (tr - T r (tr)) is still a zero-mean baseband complex Gaussian process. Given the aforementioned linear approximations for the clock and range delays, the apparent delay can be approximated by linear parameters T m,O and T m as

(16)

Assuming a nominal sampling rate Ts, the digital represen­tation of the signal '1 (tr) is given by '1[k] = '1 (kTs). The noise n (tr) is generated at each sensor based on the noise power density No in W/Hz over the single-sided noise-equivalent bandwidth Bn in Hz. Therefore, the noise power a; in Watts is given by

(17)

The complex noise time series n[k] is a scaled and filtered version of a sequence of random samples whose real and imag­inary components are independent and normally distributed. The noise samples are scaled so that

E [n[k]n*[k]] = 2a; . (18)

The emitter has an average transmitted power density Fs in W/Hz over the single-sided noise-equivalent bandwidth. The spreading loss L (p) is given by

.x2 L(P)=42c:r;2' (19)

7I"P where .xc = c/lc is the nominal wavelength of the signal. Isotropic transmit and receive antennas and no cable loss are assumed. The received signal power a; in Watts is given by

(20)

The signal component of the received signal sr[k] = sr (kTs) is scaled so that

(21)

which constrains A (P) in (2) appropriately. Finally, the received signal '1i (tr) at sensor i from M

emitters can be modeled as a sum of components of the form in (15):

M

'1i (tr) = LA (�) sl (tr - T:"i(tr)) (22) 1=1

X exp (-j [271"/cT:"i (tr) + <Pri,OJ) + ni (tr) , where the apparent delay for emitter I and sensor i is defined as a specialization of (13):

T:"i (tr) = Tri (tr) + T�i (tr - Tri (tr)) . (23)

B. The Cross-Ambiguity Function

Consider the following narrowband cross-ambiguity func­tion SZiZk (T,ID), which has been adapted from the radar literature [21], for a pair of complex baseband signals Zi (t) and Zk (t):

SZiZk (T,ID) � � rT/2 Zi (t)iZ (t + T) e-j2'/1'iDt dt, (24)

J-T/2 where T is the length of the integration interval, T is the delay, and I D is the Doppler frequency. The forthcoming equations will be simplified by using the difference operator

D.ik ( -) = (')k - ( - ) i' that is, the placement of a D.ik in front of a quantity indicates a difference of that quantity between sensors i and k. The cross-ambiguity function Sf;fk (T,ID) for a pair of signals '1i (t) and '1k (t) from receivers i and k, respectively, using the single-emitter propagation model in (15) and linearized apparent delay is approximately given by

Sf;fk (T, ID) :::::i O!ikSss (T - D.ikTm,O, ID - D.ikTmlc) + Nik (T,ID) , (25)

where the complex attenuation factor O!ik is defined as

O!ik = A (Pi) A (Pk) d[211"�ikT""ofc+�ikq,r,ol (26)

and Nik (T, I D) is the noise function, which includes all correlation terms involving the noise signal n (t). In (25), it is assumed that the apparent range rate Tm, which is

457

related to the velocity of the emitter and oscillator clock drift rate, is small and has negligible impact on the correlation over the integration interval. The impact is negligible if the bandwidth of the baseband signal s (t) is small with respect to the carrier frequency fe. This is known as the narrowband approximation [21]. The delay and Doppler that maximize the magnitude of the ambiguity function, denoted respectively as Tik and iD,ik, are the corresponding time and frequency difference of arrival (TIFDOA) measurements between sensors i and k for a single emitter [21].

Again, invoking the narrowband approximation, the cross­ambiguity function Sfdk (T, fD) can be written for M emitters in terms of the auto-ambiguity terms Aik (T,fD)' the cross­ambiguity terms Cik (T, JD), and the noise terms Nik (T, fD)' as

The auto-ambiguity terms are of most interest and can be written as

M

Aik (T,fD) = LaikSSlSl (T - f).ikT�,O, JD - f).ikT�fe) , l=l

(28) where the complex attenuation factor aik is defined as

aik = A CoD A CoD ej[27rClikT�,ofc+Clik4>r,ol. (29)

The cross-ambiguity terms are generally small in the delay­Doppler range of interest provided that there is no strict coordination between emitters.

III. SYNCHRONIZATION AND SIGNAL EXCISION

A. Tightly-Coupled Sensor Architecture

"Tightly-coupled" refers to an RF receiver architecture in which emitter signals and reference signals are down­converted with the same oscillator and sampled in such a way that a nanosecond-accurate correspondence can be made between the two sampled signal streams (coherent signal conditioning and sampling). Fig. 1 shows one straightforward tightly-coupled sensor architecture. Tight coupling between the emitter and reference data enables the data streams from two separate sensors to be synchronized to within nanoseconds and for clock variations over the cross-correlation interval to be estimated and compensated at the carrier-phase level. The tightly-coupled sensor architecture draws from the success of ongoing work in opportunistic navigation at the University of Texas at Austin [20, 23, 24]. Experience with GNSS signals, terrestrial signals of opportunity such as cellular COMA, and Iridium signals suggests that an emitter localization system could exploit any instance of these three signal types as a reference.

The simplest approach to a tightly-coupled sensor archi­tecture is to use GNSS signals as the reference signals. This approach allows one to exploit the well-known, clean, and stable signal characteristics of GNSS signals. GNSS signal processing can be done within the sensor to minimize network throughput requirements. For example, consider using GNSS

Emitter Signals Reference

Signals

Single Driving Clock

Joi nt Processi ng of Eminer and

Reference Signals

Figure 1: Basic tightly-coupled sensor architecture.

timing to synchronize stationary sensors in known locations. A typical GNSS navigation solution will provide estimates of the receiver clock offset Tr,O and offset rate Tr. For some sufficiently small time window, a linear model can be applied to the clock offset Tr (tr) = Tr,O + Trtr. Then, (7) can be solved for receiver time in terms of true time as

tr (t) =

t1+ T�,O = a + (1 + ,8) t, (30) - Tr

where a = t3r and ,8 = l:'+r' Invoking the narrowband signal assumption, the baseband synchronized signal f s (t) is given by

fs (t) � f (t + a) exp (j27r,8fet). (31)

Therefore, for small clock offset rates, the operations required for synchronization are simply a delay and complex mixing operation.

One might naturally question the wisdom of using GNSS signals as reference signals by pointing out that the emitter to be located may be broadcasting a strong interfering signal within GNSS frequency bands. In this case, the received GNSS carrier-to-noise ratios might be too low to support making reliable timing estimates. This paper addresses this concern in several ways.

First, significant frequency diversity is offered by the com­bined spectrum assets of modern GNSS systems like GPS, Galileo, GLONASS, and Compass. If any one of the many signal bands within these separate systems is free of interfer­ence, then signals from this band can be taken as reference signals. An in-house software-defined radionavigation process­ing engine, named "GRID," can be embedded for execution on the sensors themselves and is currently capable of acquiring and tracking GPS LI CIA and GPS L2C signals [20, 25-28]. With some fairly straightforward extensions, the GRID engine is capable of acquiring and tracking all COMA-based GNSS signals, including GPS L5, GPS LIC, Galileo, Compass, and future COMA versions of GLONASS signals.

Another approach to mitigating the effects of interference on reference signals drawn from GNSS bands is to draw the reference signals in via a directional antenna. For stationary sensors, a single GNSS signal is all that is required to provide the benefits of a tightly-coupled sensor architecture. Hence, if each sensor is equipped with a directional antenna that

458

can recover sufficient signal power from just one GNSS satellite (not necessarily the same satellite at each sensor), then the requisite synchronization between the two sensors' data streams can be established. For example, an inexpensive helical antenna pointed toward zenith would have a good chance of capturing the requisite GNSS signal and suppressing a surface-based interference signal.

A third option for dealing with the in-GNSS-bands inter­ference scenario is to capture non-GNSS signals that could be exploited in the same way as GNSS signals to synchronize and stabilize the recorded emitter data. Research at the University of Texas at Austin has shown that forward-link CDMA cellular pilot signals are an excellent reference for tightly-coupled receivers [20, 23, 24]. Typical CDMA cellular base stations transmit signals that arrive with 40 dB greater power than GPS signals, are synchronized to GPS time to within a few microseconds, and offer coherence times at L-band in excess of 100 s [20). Periodic calibration of forward-link signals during times of GNSS availability can reduce CDMA signals' timing uncertainty to nanoseconds. Thus, for applications where CDMA cellular signals are available-for example, within the US-they represent an excellent backup to GNSS signals for tightly-coupled emitter localization. The GRID software-defined radionavigation processing engine is capable of acquiring and tracking forward-link CDMA cellular pilot signals (see Fig. 2). As with GNSS signals, this processing can be executed onboard the sensors.

---=_ ... _ ..... - GRID: General Radionavigation Interfusion Device ."""""""''''''''--=---

Receiver time: 0 weeks 160.0 seconds Build ID: 1379 GPS time: 1614 weeks 420784.0 seconds

CH TXID Doppler BCP PR C/NO Az El Status

(Hz) (cycles) (meters) (dB-Hz) (deg) (deg) -------------------------GP5_Ll_CA Channels--------------------------------

1 lu 430.75 -76149.17 20972555.14 46.3 301.7 12.9 6 2 2 -2337.63 372213.50 20793027.57 44.1 93.0 10.8 6

-2814.11 449035.30 19188750.37 52.3 42.0 32.0 6 4 15 2229.20 5 18 2228.97 6 21 2027.74 7 25 -2734.77 8 26 410.60 9 29 398.14

10 30 -731.36 11 12

-362763.30 -360186.88 -324302.89

436530.00 -75412.16 -71226.59 110014.30

------------

------------

17919804.83 53.6 149.9 48.9 19526452.99 48.6 243.3 29.8 19403848.18 51. 0 306.8 34.8 20267387.49 47.7 218.6 19.7 17644648.06 54.0 88.4 47.0 16810240.92 52.1 287.2 79.5 20121635.88 46.5 282.3 18.5 -----------

-----------

-------------------------CD�UHF _P I LOT Channe 1 5---------------------------

1 1 -0.59 91.58 7622658.88 62.0 0.0 0.0 5 ------------------------------Navigation Data------------------------------

X: -745467.86 Y: -5462657.31 Z: 3196401.16 deltRx: -3464962.30 Xvel : 0.03 Yvel: -0.04 Zvel: 0.01 deltRxDot: 0.12

Figure 2: Screen output of the GRID software-defined radion­avigation engine showing simultaneous tracking of 10 GPS Ll CIA signals and 1 CDMA cellular forward-link pilot signal.

B. Reference Signal Excision

If the emitter and reference signal band are the same, then the ambient reference signals will cross-correlate in the same way as the emitter signals. Therefore, to improve sensitivity to the emitters of interest, it is advantageous to track and remove the ambient reference signals if they have high enough carrier-to-noise ratios before cross-correlation. In CDMA systems, the loss of sensitivity to weak emitters in the presence of strong emitters is known as the near-far effect, and interference cancellation is a commonly-used technique

to solve this problem [29, 30]. In addition, the technique was used in [31] to crack the Galileo test codes using the Ll­band signals received from a patch antenna, where a software GPS receiver was used to acquire, track, and remove the nuisance GPS/SBAS signals. Ref. [12] considers the same issue when trying to locate weak emitters in the GPS band and solves the problem by using a notch filter to remove the ambient GPS signals before cross-correlation. However, the notch filtering technique is suboptimal and reduces the available emitter signal power that could be used in cross­correlation.

IV. TDOA ESTIMATION

Many parallels can be drawn between VLBI, active radar, and passive geolocation. In the 1970s, high resolution time delay estimation techniques were developed [7, 8] using delay­parameterized models of the phase of the cross-power spec­trum (e.g. a linear model for non-dispersive delays). Similarly, in the VLBI community, the group delay estimate is typically couched in terms of a least-squares fit to the slope of the phase of the cross-power spectrum (see Appendix 12.1 of [10)). It has been shown in [32] that this least-squares approach is equivalent to the maximum likelihood estimator developed in [7, 8).

Traditional radar techniques use matched filtering (MF) to determine the delay and Doppler of targets, which is analogous to examining the cross-ambiguity function in passive geoloca­tion as in [12-14). However, MF is limited by the support of the ambiguity function of the transmitted waveform. As a re­sult, its delay resolution tends to be on the order of the inverse of the bandwidth of the transmitted waveform, and its Doppler resolution tends to be on the order of the temporal support of the transmitted waveform [21, 33]. Therefore, the ability of MF-based methods to distinguish between two closely­spaced targets is severely limited in the delay-Doppler space. In addition, the output of the matched filter leads to peaks that are not centered at the true targets for a majority of the targets due to the superposition of interfering ambiguity func­tions. Ref. [33] provides a framework for "super-resolution" radar that bypasses the aforementioned limitations for MF by parametrization of the response with a finite set of delays and Doppler-shifts and application of parametric estimation techniques like subspace methods. Non-parametric estimation techniques discretize the delay and Doppler space into a grid and determine if a target is present at each grid point. Given the limitations of non-parametric estimation especially under multiple targets, a parametric approach to estimating the TDOA of emitters is developed in the subsequent subsection.

A. A Parametric Approach to TDOA Estimation

Consider the following model for the CPSD between a pair of sensors,

M "\7_ - (f) - ,",,.,,l Y-t-t (f) e-j271: f'r;k + N- - (f) J.'1'irk - � 1--f.ik s s rirk ,

1=1 (32)

459

where aik and rfk are respectively the complex scale factor and the TDOA between sensors i and k of emitter l, Yslsl (f) is the normalized power spectral density of emitter l, and Nf;fk (f) contains terms due to noise and cross-correlation between the emitter waveforms. Note that the CPSD could be estimated by the discrete Fourier transform of a Doppler cut at some f D of an estimate of the ambiguity function Rr;fk (r) = Sf;fk (r,fD). Note that in the case of synchro­nized sensors and stationary emitters and sensors, fD = O. The ambiguity function should be windowed appropriately so that only delays of interest, which are driven by the sensor pair's baseline or known emitter waveform repetition rate, are considered. Assuming that the emitter waveforms have normalized, wide, flat frequency spectra (Yslsl (f) = 1) and are uncorrelated (E [Nf;fk (f)] = 0), then the measurement model for the power spectral density is given by

M Yrifk (f) = L aik exp (-j27rfrfk) + Nfifk (f) . (33)

l=l

The problem is now in terms of parametric estimation of com­plex exponentials in noise, a well-studied problem [15, 34]. First, guesses for the TDOAs and the number of emitters are initialized using subspace methods like MUSIC [15]. Then, estimates of the power and TDOAs are iterated in a least­squares fitting algorithm until a convergence condition is met. The complex scale factors are estimated using linear least squares fitting (note that aik appears linearly in Yfifk (f) and the TDOAs are updated using an iteration of nonlinear least squares fitting.

B. Subspace Methods for TDOA Estimation

A brief description of subspace methods is provided. Con­sider a tapped delay line of length K > M that uniformly samples Yf;fk (f) with sampling interval !:l.f. The data model for the tapped delay line is given in (34) on the next page, where fk = fo + k!:l.f, or, in vector form,

Y=EA+N, (35)

where A E <eM x 1 is a vector of complex scale factors, E E <eKxM is a matrix composed of mode vectors e (r) E

<eKx 1, and N E <eKx 1 is a complex noise vector, with

real and imaginary parts distributed normally N (0, 0";1) and uncorrelated with the parameters. The mode vector e ( r) is given by

[:�� � =;;;����l e(r) = . .

exp (-j27rfKr) Let the K x K covariance matrix S be defined as

S = E [yyH] = E E [AAH] EH + O";E [NNH]

(36)

= EPEH + 0";1, (37)

where P is the covariance of the complex scale factors. Given a single, uniformly sampled observation of Yfifk (f) of length P with sampling interval !:l.f, x[k], the covariance matrix can be estimated using the "forward-backward" averaging method [35] as

where

X=

A

H S=X X,

x[K+I]

x[P-K]

x[P] x*[I]

x*[K + 1]

x*[P-K]

(38)

x[I]

x[K+I]

x[P-K] x*[K + 1] (39)

x*[P-K]

x*[P]

The K eigenvectors Vi and eigenvalues Ai of S must satisfy SVi = AiVi, for i = 1,2, . . . , K. Assuming that all the mode vectors are linearly independent (i.e. E has full rank), then for M < K, the matrix EPEH is singular and it can be shown that S has K -M eigenvalues equal to 0"; . In fact, an estimate of M can be computed by subtracting the multiplicity of 0"; in the eigenvalues of S from K. Since S = EPEH + 0";1, then EPEHvi = (Ai -0";) Vi is true. Note that for each eigenvalue Ai = 0";, EHVi = 0, i.e. the "signal" subspace E (spanned by the mode vectors) is orthogonal to the "noise" subspace EN (spanned by the eigenvectors associated with Ai = 0";) [15].

Note that in practice, only estimates of S are available, and the aforementioned conditions are only approximately satisfied. Therefore, the eigenvalues associated with the noise subspace are not exactly 0";, and instead are clustered about 0"; (and the spread of the cluster decreases with more averag­ing) [15]. Estimating M can be particularly difficult when the gap between the eigenvalues associated with the signal and noise subspace is not clear. Hypothesis tests for estimating M were developed using matrix perturbation theory in [35]. However, for ease of implementation and prototyping, the present algorithms require a priori knowledge of M and/or subjective analysis of the eigenvalues of S (or equivalently the singular values of X). The MUSIC cost function is given by

JMU (r) = eH (r) ENE�e (r) , (40)

which for uniformly sampled signals, can be minimized using Root-Music [36, 37].

The above algorithms are limited in that the data model assumes flat emitter frequency spectra. The performance of the algorithms degrade with model mismatch, and in par­ticular, simulation results indicate MUSIC makes biased or spurious TDOA estimates when the flat spectra assumption is relaxed. Also, the resolvability of two closely-spaced TDOAs decreases as their separation decreases in the presence of noise.

460

The mode vectors associated with closely-spaced TDOAs are nearly linearly dependent, which causes the one of the eigen­vectors in the signal subspace to have a small eigenvalue. In the presence of noise, the eigenvector can not be distinguished from the noise subspace if the associated eigenvalue is too small, hence the loss of resolution.

V. EMITTER IDENTIFICATION AND LOCALIZATION

In passive geolocation, the estimated TDOAs between all possible pairs of sensors must be associated with possible emitters. Sathyan and others have proposed algorithms to solve this data association problem inherent in passive geoloca­tion [16]. However, the currently implemented algorithm uses the principle of phase closure to verify that a triad of TDOA measurements can be associated with the same emitter. The closure-based algorithm is a simple and effective prototype but more sophisticated methods may be implemented if they prove to be more effective. Consider three true (noise-free) times of arrival (TOAs) of an emitter signal Ti, Tj

' and Tk to sensors

i, j, and k, respectively. The sensors can be paired in three ways, forming three true TDOAs: Tij = Tj - Ti, Tik = Tk - Ti, and Tjk = Tk - Tj. The TDOA measurements

(41)

are assumed to be corrupted by zero-mean noise nij with covariance given in [13, p. 64]. The TDOA closure metric is defined as

(42)

Under the hypothesis that the TDOA measurements are as­sociated with an emitter, then E [Tel = 0 and E [T;] = E [(nij - nik + njk)2] . A test can be constructed in which

a threshold Te,th is chosen such that T; < T�th indicates that the TDOA measurements under test can be associated with the same emitter for a certain probability of false alarm, although this paper does not carry out the entire analysis of the detection statistic. If a triplet of TDOA measurements "close," then, geometrically, the three hyperbolas intersect at a single point on a plane. However, ambiguities arise when different combinations of TDOA measurements could result in the same TDOA measurement between a pair of sensors. Geometrically, the ambiguity can be interpreted as a single hyperbola being intersected by other pairs of hyperbolas at more than one point as shown in Fig. 3. Information from other sensor triads, if available, must be used to resolve the ambiguity. Also note that additional TDOA measurements caused by multi path reflections will possibly close, yielding extraneous position solutions.

X Sensors -400 * Emitte rs _ 6 00 �-;-;;=Hy=p�e=r=b�o=l a=s���������

-500 o 500 X (m)

1000

(34)

Figure 3: TDOA hyperbola map for a three-emitter scenario in which there are ambiguous phase closures. Note that there are five 3-way intersections of hyperbolas, but only three emitters.

Typically a nonlinear least-squares algorithm is used to locate an emitter given a set of TDOA measurements. Note that a TDOA measurement constrains the emitter position to a hyperbola of revolution. Chan and Ho describe a computationally-efficient estimator for hyperbolic location by using an intermediate variable to reduce the nonlinearities in the problem [38]. However, for simplicity, a standard approach to the problem is implemented. The TDOA measurements that have been associated with a particular emitter are reduced to an independent set of TDOA measurements fIk' one for each of the sensors involved except for a reference sensor k, using a linear least squares approach [13, p. 63]. This approach exploits the following linear relationship between TDOA measurements,

(43)

where Tkk = O. Given N TDOA measurements involving M sensors, N equations of the form in (43) can be stacked so that

z=Hz', (44)

where z E IRNXl is the vector of TDOA measurements with noise covariance matrix R E IRNXN, Z' E IR(M-l)Xl is the vector of M - 1 independent TDOA measurements, and H E

IRNx(M-l) is the sensitivity matrix governed by the model

461

1200

1000

800 .

-500 500 x (m)

1000

(a) "Closed" TDOA hyperbolas.

-500 500 x (m)

1000

(b) "Unclosed" TDOA hyperbolas.

Figure 2: Geometric interpretation of TDOA closure metric.

in (43). A least squares solution for z' is given by

i' = R'HTR-1z

where

R' = (HTR-1H) -1.

(45)

(46)

Each of the independent M - 1 TDOA measurements ilk in i' can be modeled as a nonlinear function of the unknown emitter location and the known sensor locations by

(47)

where Pi is the true range between sensor i and the emit­ter and n�k is zero-mean noise. The stacked noise vector

[ ... ,n�k'" . ]T , arranged in the order of i', has covariance

R'. A nonlinear least squares search algorithm can be used to estimate the unknown emitter location.

VI. IMPLEMENTATION AND RESULTS

A. Theoretical TDOA Estimation Error Bounds

Many derivations of the Cramer-Rao lower bound (CRLB) for single-emitter TDOA precision exist in the literature [9, 10, 13]. One form of the CRLB is given by

81T2Ta2a2 Jt:.J /2 S2 (/) /2dl' t J -t:.f12 s :I

(48)

where a�,7";j is the error variance of the TDOA estimate under

a weak received power assumption, i7� 7" . is the minimum , '3 value this variance can attain (the CRLB), T is the integration time, Ss (f) is the emitter signal power spectral density, 6./ is the captured bandwidth, ai and aj are the amplitude atten­uation of the emitter signal, and No,i and NO,j are the noise power density, all for the i, jth sensor pair. If, in addition to the received power being weak, the transmitter signal is spectrally

flat within the captured band (i.e., Si = a;Ss « NO,i, Sj = aJSs « NO,j), then (48) reduces to

2 3 No No ' 3 > ,t ,J (49) aW,7";j - 21T2TSiSj6.j3 1T2SNRp6.j2'

where SNRp = 2T 6./ (�;,;) ( ;'/j) is the "passive" cross­

correlation signal-to-noise ratio [10]. Relaxing the weak emit­ter power assumption yields a slightly modified CRLB [9],

2 > -2 ( Si Sj ) a 7" . _ a W 7". . 1 + r;r- + � .

'tJ , 1,J lVO,i lVO,j (50)

Also, [13, p.64] gives expressions for the noise covariance of the TDOA measurement model in (43) as

E [n;jJ = a;;J' (51)

3 No ' E [nijnjk] = 21T2TS;�j3 = -E [nijnkj], (52)

E [nijnkd = O. (53)

Note that for a fixed number of data samples, or equivalently, constant time-bandwidth product T 6./, TDOA precision im­proves only by increasing the captured bandwidth or increasing the emitter power density. In the subsequent subsection, the simulator performance will be compared to the theoretical performance according to the CRLB.

B. Simulated TDOA Estimation Peiformance

A simulator has been developed to provide guidance and evaluate the performance of the estimation algorithms. The simulator generates the complex baseband samples that would be received at the sensors from any number of emitters using the models and approximations developed in Sec. II. In the simulator, the emitter waveform is oversampled by some integer factor of the receiver sampling rate in order to model the delay with sub-sample resolution using linear interpolation. Currently, the simulator supports generating three types of emitter waveforms: white noise, GPS signals, and continuous

462

wave signals with linear chirp modulation. The simulated noise time series and emitter waveforms are filtered by a iOth­order Butterworth filter with cutoff frequency Bn to model the sensor front-end filter. The emitter is assumed to be trans­mitting throughout the duration of the simulation, which lasts from 1-100 milliseconds so that the linear approximations are satisfied.

The TDOA estimation algorithms developed in Sec. IV are verified in a simulation study. The raw samples generated by the simulator are cross-correlated for each sensor pair and the resulting CPSDs are used as inputs to the TDOA estimator. Monte Carlo runs of this configuration yield TDOA estimates whose error variance approaches the theoretical CRLB in (50) for a representative single-emitter scenario. The baseline configuration of the simulator includes one 1 m W white noise emitter that is equidistant from two perfectly synchronized sensors with a 20 kIn baseline, an integration time of 10 ms, and a captured bandwidth of 500 kHz. The CRLB of the baseline configuration is 10 m. Figs. 4, 5, and 6 show this comparison while varying the parameters T (integration time), tlj (captured bandwidth), and Ss (emitter power density) around the baseline configuration. The red vertical line in the figures indicates when the parameters are equivalent to the baseline scenario. Clearly, the implemented TDOA estimator under single-emitter conditions approaches the CRLB; how­ever, the estimator becomes unreliable for small integration times and weak emitters since SNRp is below the estimator's detection threshold.

>< o >< >< w " 8 10' .. f-<

10-2 Integration Time (5)

Figure 4: TDOA precision comparison while varying integra­tion time T, holding all other parameters constant.

Now consider an extension of the baseline scenario in which the single emitter is replaced by two emitters with some separation distance having geometry as shown in Fig. 7. Figs. 8 and 9 highlight the predicted breakdown of the esti­mator when TDOA separation decreases for several different values of emitter power. The two emitters were assumed to transmit at equal power. Note that to improve the estimator performance slightly, only 80% of the captured bandwidth was

E

� 10' "0 1 "0 ... <I) >< o >< >< w 100 " o o f-<

10 -, '-:-_----'_---'-------'----L--'---'---'--'--'--:-__ '---------'-----'-----'----'----'--'---'-.J 105 10' 107

Captured Bandwidth (Hz)

Figure 5: TDOA precision comparison while varying the captured bandwidth tlj, holding the time-bandwidth product and other parameters constant. The time-bandwidth product is held constant to reduce execution times of the simulator and estimation algorithms. Note that it is acceptable to hold the transmitted emitter power density constant because it is assumed that transmitted emitter bandwidth is larger than the captured bandwidth, which is usually the case for GPS jammers [2].

1 0 -2 '--:...C-'...;..;..;.;.;.a.-:-'-,-,,-,-,-,,",--:---,----,--,-;";';';;"--:--,-,-,-,-;.;.;.;J.-:-'-'-'-'-"C.J 10-' 10-3 10-2 10-' 10° 10'

Emitter Power (W)

Figure 6: TDOA precision comparison while varying the emit­ter power density S s, holding all other parameters constant.

considered so that the spectrum contributing to the CPSD did not contain the edges of the simulated front-end filter. For this simulation, the emitters are considered resolved when the estimated TDOAs are within 50% TDOA separation of the true TDOAs. The gradual increase in error as the TDOA separation decreases is due to the mode vectors becoming correlated (i.e. E in (37) is nearly singular). The spikes in error at certain TDOA separations are due to the complex attenuation factors of the two signals being almost 180 degrees apart in

463

phase, causing destructive interference. Note that constructive interference occurs when the TDOA separation is an integer multiple of the transmitted wavelength, which, for GPS L1, is approximately 19 cm. The TDOA resolution offered by the proposed multiple-emitter algorithm is better than matched­filtering (MF) techniques, whose resolution is typically limited by �f-l [21, 33]. For the baseline scenario, MF resolution is 600 m, which is when the main lobes of the ambiguity functions associated with each emitter begin interfering.

• S

o E

o E

• S

Figure 7: Sensor geometry for multiple-emitter baseline sce­nario. The sensors and emitters are collinear and symmetric about the dashed line.

120

100

E

> 80 " " I " '-' <fl 60 . " 0 " " "

40 . .0: 0 0 E-<

20

� 02 103

TDOA Separation (m)

Figure 8: TDOA precision while varying the TDOA separation and emitter power, holding all other parameters constant. The emitters were placed in such a way to keep SNRp approximately constant for all TDOA separations.

C. Prototype System Peiformance

1) Prototype Sensor: To support live testing, a small emitter localization network has been implemented in Austin, TX. The network comprises one mobile sensor and two fixed RF sensors. The fixed sensors, located at the University of Texas Center for Space Research and Applied Research Laboratory, straddle a major highway. The fixed sensors are denoted CSR and ARL and the mobile sensor is denoted MBL. A pictorial overview of the network is given in Fig. 10.

Each of the sensors in the network is composed of

• Two Ettus Research Universal Software Radio Peripheral (USRP) N200s.

• One Dell Precision T3500 workstation (fixed sensors) or one Panasonic Toughbook laptop (mobile sensor).

100

90

;; 0 80 rl

.c x 70 -� � :>-<fl <fl 60 " " " " ",-, 50 4-<'-' 0 ·'"

E 40 " " " " .0" 30 E > "rl Zo

<fl 20 " " 10

�02 103 10'

TDOA Separation (m)

Figure 9: TDOA resolution performance under the same conditions as Fig. 8

O Fixed St:!n�ot

Mobile Semor

Figure 10: The University of Texas at Austin Prototype Emitter Localization Network.

• One oven-controlled crystal oscillator (OCXO) serving as a local frequency reference.

• Required antennas, amplifiers, and cabling.

The USRP N200 with the DBSRX2 daughterboard, shown in Fig. 10, down-converts and digitizes RF signals between 800 MHz and 2.4 GHz. The USRP N200s are connected together with a MIMO cable so that their clocks are syn­chronized to within 1 ns. In the fixed stations, the raw complex samples generated by the pair of N200s are sent to the Dell workstation via Gigabit Ethernet. The USRP N200 supports complex sampling rates up to 25 MHz for 16-bit samples and up to 50 MHz for 8-bit samples with experimental firmware. The antenna used for receiving emitter signals is broadband (750-3000 MHz) and directional, with a peak gain of 7 dBi. One USRP is dedicated to sensing the emitter to be tracked and the other is used for receiving timing signals

464

from GPS or CDMA to synchronize the sensor network. Fig. 10 shows the antenna configuration on the rooftop of the CSR station. GPS signals are received from a separate hemispherical GPS antennas, rather than from the broadband emitter antenna, because the hemispherical antenna has better multi path mitigation properties and more signals in view. The ARL station has a similar configuration.

The MBL station, shown in Fig. 11, is identical to the CSR and ARL stations except that (1) data are collected on a laptop, (2) a narrowband 2300 MHz antenna is used for receiving the emitter signal, and (3) the narrowband antenna gain pattern is azimuthally homogeneous whereas the broadband antenna used at CSR and ARL has a 3-dB beam width of approximately 70 degrees.

The network includes a non-real-time MATLAB-based pro­cessing center. A web interface has been developed to auto­mate data capture from each of the stationary sensors (CSR and ARL) as shown in Fig. 12. High-resolution data (16-bit quantization) are streamed over the campus network to a central processing computer for after-the-fact processing. Data from the mobile sensor are recorded locally to hard disk and brought back to campus for processing. When all data for a particular capture window have been loaded onto the central processor, an automated sequence of processing steps is executed, with some manual supervision.

Figure 12: Web recording interface for stationary sensors shown on cell phone browser with laptop controlling USRP E l 00 emitter in background.

2) Localization: To illustrate the operation of the prototype network, results are offered from a test exercise attempting to locate two emitters placed in the parking lot of a shopping center near the centroid of the sensor network. Two USRP El00s served as emitters. These were programmed to transmit either the GPS L1 CIA chipping sequences for PRNI or PRN2 at 1 Mcps with carrier frequency of 2.305 GHz, which falls in the US amateur radio band. The emitters transmitted ap­proximately 10 m W of power and were operated under a valid amateur radio license. The sensor's complex sampling rate was set to 2 Msps for the emitter and reference channels. The test exercise's emitter-sensor geometry is shown in Fig. 13.

X S e n s o r s * Emi t t e r s

1 6 0 0

1 4 0 0

1 2 0 0 . . )( CSR

1 0 0 0

5 8 0 0 >-<

6 0 0

4 0 0

2 0 0

0 )i( .ARL .

- 2 0 0 - 1 0 0 0 - 5 0 0 o 5 0 0

X ( m )

Figure 13: Location of sensors and emitters for test exercise.

Before proceeding with standard cross-correlation tech­niques for locating the E100 emitters, the emitter data from each sensor were processed in a so-called active tracking mode. In this mode, knowledge of the signal structure is assumed; thus, correlation against a noise-free local signal replica is possible. In typical emitter localization scenarios, active tracking is not possible because one does not know the exact emitter signal structure. Passive tracking based on cross­correlation of data from multiple sensors is used instead. In the test exercise, active tracking was used at first only to get information about the multipath environment and the emitters' relative signal strengths. Active tracking revealed that each sensor received the two emitter signals with comparable signal strength, although the signal from PRN2 was stronger in all cases (Fig. 14), and the ARL station data showed significant multipath distortion in the PRNI code (Fig. 15).

Emitter data from the three sensor pairs were cross­correlated and estimates of the CPSD are formed. Multiple emitters were manifest in the CPSD as a sum of complex exponentials in the frequency domain. The quasi-sinusoidal patterns in the real and imaginary traces in Fig. 16 are the result of a complex superposition of components from the two emitters sensed by the ARL-MBL sensor pair.

MUSIC separates the signal from the noise subspaces, yield­ing estimates of the TOOAs. One can either assume knowledge of the number of emitters present or attempt to estimate this number based on the MUSIC singular values. The CSR-ARL pair whose MUSIC singular values are plotted in Fig. 17 shows evidence of three possible emitters of comparable strength due to the multipath corruption that was noted in connection with Fig. 15. Fig. 17 highlights the fact that MUSIC can be used to estimate the number of emitters (or, in reality, the number of strong RF propagation paths) present. For the test exercise,

465

(a) The GPS and 2300 MHz antenna are placed on top of the vehicle. (b) The USRP N200 RF recording equipment, power supply, and OCXO are placed inside the vehicle.

Figure 11: The MBL station is parked on top of a tall, nearby parking garage to ensure line-of-sight view of the emitters.

<IJ '"' .... § 5 . ' '0 c <II .', 4 c o ... ....

I - PRN 1 1 -- PRN2

3 3 . 2 3 . 4 3 . 6 3 . 8 Code Phase (m)

X 10'

Figure 14: Active tracking of GPS L1 CIA PRN codes in CSR data reveals the presence of the two emitter signals.

it was assumed that the CSR-ARL and ARL-MBL sensor pair detected three emitters and the CSR-MBL pair detected only one emitter, which seemed to best fit the data. Note that in the CSR-MBL pair, the TOOAs associated with the two emitters were too closely spaced to be resolved given the SNRp in this test exercise.

The estimated TOOAs must each be associated with a par­ticular emitter. This is done by examining the TOOA closure metric which should be small when emitters are correctly associated. For the exercise, the closure threshold was sub­jectively chosen to be 100 m. Once a TOOA 3-tuple has been associated, emitters can then be precisely located at 3-way hyperbolic intersection points. Hyperbolic trace estimates from five independent data segments are overlaid in Fig. 18 with 1 s integration time. Fig. 19 shows the corresponding emitter location estimates, but because of the multipath corruption, three possible emitter locations are shown. Note that the

X 109

<IJ

.� 5 c ;:l '0 c r 4 ' '"' c o ... � 3 '

... <II :. o '" 2 c o .... +J '"

.-< 1 ' <II ... ... o u

I - PRN 1 1 -- PRN2

o ���--�L-���������----� 2 . 2 8 2 . 29 2 . 3 2 . 3 1 2 . 32 2 . 33

Code Phase (m) x 10'

Figure 15: Active tracking of GPS L1 CIA codes in ARL data shows significant multipath distortion of the PRNI code. The peak of the PRN2 code is outside the code phase window.

TOOA measurement resulting from the CSR-MBL sensor pair closes more than one 3-tuple of TOOAs, so it was assumed that there could be an emitter at each of those intersections.

The location precision is about 20 m and the mean of one cluster of position estimates is within 10 m of a true emitter (PRN2). It is not known whether the other position clusters are associated with the other emitter (PRNl) or multipath. The absolute location accuracy is limited by not accounting for the antenna heights of the sensors and emitters and the differential delay between the reference and emitter channel due to 100s of feet of coaxial cable at the fixed sensors and frequency-dependent biases in the USRP front end.

Note that if only one emitter is assumed to be present in the received data, then the TOOA estimates become biased and jump between different emitters as their strength varies as shown in Figs. 20 and 21. Clearly, multiple-emitter TOOA

466

1 6 x 1 0'

_ 1 4 <fJ "-' .� 1 2 " -g 1 0 Q) "-'

8 c 0 '" ::'. ;., "-' 4

.� <fJ C Q) 2 0

_ 4 L-______ -L ________ � ______ �� ______ �

- 1 - 0 . 5 0 Frequency ( Hz)

0 . 5 X 1 0'

Figure 16: Cross power spectral density estimate for ARL­MEL pair based on 1 s of coherent averaging. Multiple emitters are manifest as a sum of complex exponentials in the frequency domain. The light blue line indicates the boxcar frequency weighting applied when estimating TDOAs for each emitter.

Q) " r< '" "

1 0

1 0

� 1 0 r< " '" c .� <fJ

1 0

1 0

7

0 0

,

,

,

3

v

0 0 0 0 0

5 1 0

0 0

singu lar value index

0 0

0

0

1 5

Figure 17: Singular values produced by the MUSIC algorithm for the CSR-ARL pair. Assuming three emitters, the green lines indicate the boundary of the signal subspace and the red lines indicate the boundary of the noise subspace. Note that there is a clear separation between the strongest noise singular value and the weakest signal singular value.

X S e n s o r s 1 6 0 0 * Emi t t e r s

1 4 0 0

1 2 0 0

1 0 0 0

.s 8 0 0 ><

6 0 0

- 1 0 0 0 - 5 0 0 o 5 0 0 X (m)

Figure 18: TDOA hyperbola map for the amateur band test exercise with an effective captured bandwidth of 1.5 MHz and integration time of 1 s.

1 6 0 0

1 4 0 0

1 2 0 0

1 0 0 0

.s 8 0 0 ><

6 0 0

4 0 0

2 0 0

0

- 2 0 0 - 1 0 0 0 - 5 0 0

X S e n s o r s * T r u e Emi t t e r s o E s t . Emi t t e r s

o 5 0 0 X (m)

Figure 19: Estimated emitter locations for five independent runs with 1 s coherent integration.

estimation techniques are required for accurate emitter local­ization.

VII. CONCLUSIONS

A full picture, from theory to hardware implementation with field experiments, of a multiple-emitter localization system is offered. A novel multi-reference synchronization strategy based on a tightly-coupled sensor architecture is adopted. A focus on multiple emitters (as opposed to the single-emitter focus of prior work on interference localization) leads to a TDOA estimation strategy based on parametric estimation

467

1 6 0 0

1 4 0 0

1 2 0 0

1 0 0 0

E 8 0 0 >-<

6 0 0

4 0 0

2 0 0

0

- 2 0 0

X S e n s o r s * Emi t t e r s

- 1 0 0 0 - 5 0 0 0 X (m)

5 0 0

Figure 20: Hyperbolas generated by estimated TDOAs with the single-emitter assumption and an integration time of 1 s.

X S e n s o r s 1 6 0 0 * True Emi t t e r s

0 E s t . Emi t t er s 1 4 0 0

1 2 0 0 )( X

1 0 0 0

..s 8 0 0 >-<

6 0 0

4 0 0

2 0 0

0 X

- 2 0 0 - 1 0 0 0 - 5 0 0 0 5 0 0

X (m)

Figure 21: Estimated emitter locations with the single-emitter assumption and 1 s coherent integration.

techniques. The precision of the proposed TDOA estimator approaches the CRLB in a simulated representative scenario. Although the estimator becomes unreliable at low SNRp or for closely-spaced emitters, it outperforms non-parametric matched-filtering-based techniques. Field tests show 20 m localization precision for five independent runs. Multipath is a significant challenge because it introduces false TDOA mea­surements that are consistent, leading to false emitter location estimates. Future work will configure the prototype system to detect and localize emitters in the GNSS bands, explore UAV­based platforms to mitigate multipath and allow feedback­based, adaptive sensor network geometries, and modify the

processing algorithms to jointly estimate TDOA and FDOA in order to localize moving emitters.

ACKNOWLEDGMENT

This work was generously supported by Coherent Naviga­tion through a sponsored research agreement. The authors also thank the members of the UT Radionavigation Laboratory.

REFERENCES

[1] National PNT Advisory Board, "Jamming the Global Positioning System - A national security threat: Recent events and potential cures," Nov. 2010.

[2] R. Mitch, R. Dougherty, M. Psiaki, S. Powell, B. O'Hanlon, J. Bhatti, and T. Humphrys, "Signal char­acteristics of civil GPS jammers," in Proceedings of

the ION GNSS Meeting, (Portland, Oregon), Institute of Navigation, 2011.

[3] S. Pullen and G. Gao, "GNSS jamming in the name of privacy," Inside GNSS, vol. 7, Mar.!Apr. 2012.

[4] Department of Homeland Security official. private com­munication, Sept. 2011.

[5] Federal Communications Commission, "Public Notice DA-05-1776," June 2005.

[6] T. E. Humphreys, "The GPS dot and its discontents: Pri­vacy vs. GNSS integrity," Inside GNSS, vol. 7, Mar.! Apr. 2012.

[7] B. Hamon and E. Hannan, "Spectral estimation of time delay for dispersive and non-dispersive systems," Applied

Statistics, pp. 134-142, 1974. [8] E. Hannan and P. Thomson, "Estimating group delay,"

Biometrika, vol. 60, no. 2, p. 241, 1973. [9] c. Knapp and G. Carter, "The generalized correlation

method for estimation of time delay," Acoustics, Speech

and Signal Processing, IEEE Transactions on, vol. 24, no. 4, pp. 320-327, 1976.

[10] A. Thompson, J. Moran, and G. Swenson, Inteiferometry

and Synthesis in Radio Astronomy. Wiley, 2001. [11] O. Isoz, A. T. Balaei, and D. Akos, "Interference detec­

tion and localization in the GPS L1 band," in Proceedings

of the ION ITM, (San Diego, CA), pp. 925-929, Institute of Navigation, Jan. 2010.

[12] J. Lindstrom, D. M. Akos, O. Isoz, and M. Junered, "GNSS interference detection and localization using a network of low-cost front-end modules," in Proceedings

of the ION GNSS Meeting, Institute of Navigation, 2007. [13] K. G. Gromov, GIDL: Generalized Inteiference Detec­

tion and Localization System. PhD thesis, Stanford University, March 2002.

[14] M. B. Montminy, "Passive geolocation of low-power emitters in urban environments using TDOA," Master's thesis, Air Force Institute of Technology, Mar. 2007.

[15] R. Schmidt, "Multiple emitter location and signal pa­rameter estimation," Antennas and Propagation, IEEE

Transactions on, vol. 34, pp. 276 - 280, Mar. 1986. [16] T. Sathyan, A. Sinha, and T. Kirubarajan, "Passive geolo-

cation and tracking of an unknown number of emitters,"

468

Aerospace and Electronic Systems, IEEE Transactions

on, vol. 42, pp. 740-750, April 2006. [17] L. Scott, "J911: Fast Jammer Detection," GPS World,

vol. 21, no. 11, pp. 32-37, 2010. [18] A. Brown, D. Reynolds, D. Roberts, and S. Serie, "Jam­

mer and interference location system," in Proceedings

of the ION GPS Meeting, (Nashville, TN), pp. 137-142, Institute of Navigation, Sept. 1999.

[19] A. Proctor, C. Curry, J. Tong, R. Watson, M. Greaves, and P. Cruddace, "Protecting the UK infrastructure," Inside

GNSS, vol. 6, Sep.lOct. 2011. [20] K. Pesyna, Z. Kassas, J. Bhatti, and T. E. Humphreys,

"Tightly-coupled opportunistic navigation for deep urban and indoor positioning," in Proceedings of the ION GNSS

Meeting, (Portland, Oregon), Institute of Navigation, 2011.

[21] A. Rihaczek, Principles of high-resolution radar .

McGraw-Hill, 1969. [22] M. Psiaki and S. Mohiuddin, "Modeling, analysis, and

simulation of GPS carrier phase for spacecraft relative navigation," Journal of Guidance Control and Dynamics,

vol. 30, no. 6, p. 1628, 2007. [23] K. M. Pesyna, Jr., K. Wesson, R. W. Heath, Jr., and T. E.

Humphreys, "Extending the reach of GPS-assisted fem­tocell synchronization and localization through tightly­coupled opportunistic navigation," in GLOBECOM

Workshops (GC Wkshps), 2011 IEEE, 2011. [24] K. Wesson, K. Pesyna, J. Bhatti, and T. E. Humphreys,

"Opportunistic frequency stability transfer for extending the coherence time of GNSS receiver clocks," in Pro­

ceedings of the ION GNSS Meeting, (portland, Oregon), Institute of Navigation, 2010.

[25] T. E. Humphreys, B. M. Ledvina, M. L. Psiaki, and P. M. Kintner, Jr., "GNSS receiver implementation on a DSP: Status, challenges, and prospects," in Proceedings

of the ION GNSS Meeting, (Fort Worth, TX), Institute of Navigation, 2006.

[26] B. W. O'Hanlon, M. L. Psiaki, P. M. Kintner, Jr., and T. E. Humphreys, "Development and field testing of a DSP-based dual-frequency software GPS receiver," in Proceedings of the ION GNSS Meeting, (Savannah, GA), Institute of Navigation, 2009.

[27] T. E. Humphreys, J. Bhatti, T. Pany, B. Ledvina, and B. O'Hanlon, "Exploiting multicore technology in software-defined GNSS receivers," in Proceedings of

the ION GNSS Meeting, (Savannah, GA), Institute of Navigation, 2009.

[28] B. O'Hanlon, M. Psiaki, S. Powell, J. Bhatti, T. E. Humphreys, G. Crowley, and G. Bust, "CASES: A smart, compact GPS software receiver for space weather monitoring," in Proceedings of the ION GNSS Meeting,

(portland, Oregon), Institute of Navigation, 2011. [29] A. Duel-Hallen, J. Holtzman, and Z. Zvonar, "Multiuser

detection for CDMA systems," Personal Communica­

tions, IEEE, vol. 2, pp. 46-58, April 1995. [30] P. Madhani, P. Axelrad, K. Krumvieda, and J. Thomas,

"Application of successive interference cancellation to the GPS pseudolite near-far problem," Aerospace and

Electronic Systems, IEEE Transactions on, vol. 39, pp. 481-488, April 2003.

[31] M. L. Psiaki, T. E. Humphreys, S. Mohiuddin, S. P. Powell, A. P. Cerruti, and J. Paul M. Kintner, "Searching for Galileo: Reception and analysis of signals from GlOVE-A," GPS World, vol. 17, pp. 66-72, June 2006.

[32] Y. Chan, R. Hattin, and J. Plant, "The least squares estimation of time delay and its use in signal detection," Acoustics, Speech and Signal Processing, IEEE Transac­

tions on, vol. 26, pp. 217-222, June 1978. [33] w. Bajwa, K. Gedalyahu, and Y. Eldar, "Identification

of parametric underspread linear systems and super­resolution radar," Signal Processing, IEEE Transactions

on, vol. 59, pp. 2548 -2561, June 2011. [34] R. Roy and T. Kailath, "ESPRIT-estimation of signal pa­

rameters via rotational invariance techniques," Acoustics,

Speech and Signal Processing, IEEE Transactions on,

vol. 37, pp. 984-995, July 1989. [35] J.-J. Fuchs, "Estimating the number of sinusoids in

additive white noise," Acoustics, Speech and Signal Pro­

cessing, IEEE Transactions on, vol. 36, pp. 1846-1853, Dec. 1988.

[36] A. Barabell, "Improving the resolution performance of eigenstructure-based direction-finding algorithms," in Acoustics, Speech, and Signal Processing, IEEE Interna­

tional Conference on ICASSP '83. , vol. 8, pp. 336-339, April 1983.

[37] B. Rao and K. Hari, "Performance analysis of root­music," Acoustics, Speech and Signal Processing, IEEE

Transactions on, vol. 37, pp. 1939-1949, Dec. 1989. [38] Y. Chan and K. Ho, "A simple and efficient estimator for

hyperbolic location," Signal Processing, IEEE Transac­

tions on, vol. 42, pp. 1905-1915, Aug. 1994.

469